Expression Engine Selection Cheat Sheet: AviatorScript vs QLExpress vs MVEL for Business Rule Configuration

Forum topic · ✨步子哥 · 2026-07-26

Summary

A practical comparison of three JVM-based expression engines—AviatorScript 5.4.4, QLExpress 4.1.2, and MVEL 2.5.2—for business rule scenarios such as marketing, risk control, and approval workflows. The post evaluates seven dimensions: operator readability, security, performance, extensibility, community backing, licensing, and exposure to untrusted input. QLExpress is recommended as the top overall choice thanks to Chinese-language aliases, expression tracing, Alibaba maintenance, and Apache-2.0 licensing. AviatorScript ranks second for compile-time performance and built-in sandbox support via enableSandboxMode(), but its LGPL-3.0 license and single-maintainer risk require caution. MVEL offers Java-like flexibility but lacks a built-in sandbox, making it unsuitable for public-facing inputs. Key guidance: abstract rules via a DSL whitelist early to ease future migration, since the three engines have incompatible syntax and no automated conversion tools.

Expression Engine Selection Cheat Sheet

A comparison of three JVM-based expression engines—AviatorScript, QLExpress, and MVEL—for business rule configuration scenarios (marketing, risk control, approval workflows).

Overall recommendation: QLExpress > AviatorScript > MVEL

One-line Positioning

AviatorScript (5.4.4, 2026-07, LGPL-3.0) — Compiled, high-performance, one-line sandbox. Compiles to bytecode via ASM, top-tier performance. enableSandboxMode() enables a sandbox in one call. Custom syntax (elsif/nil/fn). Single maintainer—bus-factor risk. Used by Meituan, JD StarChain, vivo.
QLExpress (4.1.2, 2026-06, Apache-2.0) — First choice for rule configuration, Alibaba-backed. Interpreted via Antlr4, no Metaspace pressure. Chinese aliases + expression tracing improve operator readability. Three-tier security plus sandbox. Maintained by Alibaba team; the most active community. Used by Taobao/Tmall, DingTalk, financial risk control.
MVEL (2.5.2.Final, 2024-01, Apache-2.0) — Full Java-like functionality, no sandbox. Compiled + interpreted dual mode; upper-middle performance. Open by default = RCE risk. No built-in sandbox; requires self-built defense-in-depth. Low maintenance activity; 3.x still alpha. Preferred embedded choice inside Drools / jBPM.

Seven-Dimension Core Comparison

| Dimension | AviatorScript | QLExpress | MVEL | |---|---|---|---| | Operator readability | Mid — custom keywords | High — Chinese aliases + tracing | Mid — Java-like | | Security safety | High — one-line sandbox | High — three-tier + sandbox | Low — no sandbox | | Performance | High — compiled bytecode | Low — interpreted | Mid — compiled + interpreted | | Extension mechanism | addFunction / use Class | Function replacement, instrumentation, fallback | Any Java call (dangerous) | | Community / backing | ~5.0k stars, single maintainer | ~5.6k stars, Alibaba | ~1.2k stars, low activity | | Commercial license | LGPL — use with caution | Apache-2.0 | Apache-2.0 | | Internet exposure risk | Recommended with sandbox enabled | Recommended with whitelist | Not recommended |

Key Differences and Pitfalls

1. Readability is the watershed. QLExpress supports Chinese aliases (如果/则/否则) plus expression tracing and attribution, making it the most friendly for operator self-service. Aviator requires training; MVEL requires Java basics. 2. Security is the lifeline. MVEL is open by default, equivalent to Java source—CodeQL rates it 9.3. Aviator must explicitly call enableSandboxMode(); QLExpress requires 4.x + whitelist/sandbox + timeout. For untrusted input from the public internet, MVEL is immediately disqualified. 3. License trap. AviatorScript is LGPL-3.0; embedding in closed-source commercial products requires compliance isolation or a commercial license. QLExpress and MVEL are Apache-2.0 with no burden. 4. Performance is not the bottleneck. In rule configuration scenarios: Aviator ≈ MVEL (compiled) > QLExpress (interpreted). Unless on an extremely high-frequency path, performance should not be the primary selection criterion. 5. Migration cost is high. The three engines have mutually exclusive syntax with no automated migration tools. Abstract rules into a DSL based on a function/operator whitelist early to reduce coupling. 6. Misconception correction. The Struts2 RCE was OGNL, not MVEL. MVEL's real RCE lesson comes from Elasticsearch / Unomi, where user input was evaluated by default.

Selection Recommendations (Business Rule Configuration Perspective)

Operator readability + Chinese aliases + Alibaba ecosystem → QLExpress
Performance + controllable security + compiled mode → AviatorScript (with sandbox enabled)
Java-like full functionality + existing Drools → MVEL (embedded use)
Untrusted internet input → AviatorScript / QLExpress (MVEL banned for direct connection)
Trusted internal complex scripts → MVEL usable (with Strict mode + class whitelist)
Mature decision → First choice overall: QLExpress. Performance-sensitive: AviatorScript. MVEL only for Drools ecosystem or trusted internal use.

Decision-Making One-Liners

1. "The essence of rule configuration is human-readable configuration + controllable and observable + secure" — QLExpress is the most balanced across five dimensions. 2. "Aviator offers both performance and security, but LGPL + single-maintainer trade-offs" — suitable for teams that can accept the license risk. 3. "MVEL is the most flexible, but it offloads the security burden to the application layer" — disqualified for untrusted input. 4. "Security is not given by default" — Aviator requires enableSandboxMode, QLExpress requires 4.x + whitelist, MVEL requires self-built defense-in-depth. 5. "Check LGPL first for licensing" — AviatorScript embedding in closed source requires compliance; QLExpress / MVEL have no burden. 6. "No automated migration tools" — abstract a rule DSL early to reduce engine coupling.